qemu-block
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [RFC PATCH-for-5.1 v2] hw/ide: Cancel pending DMA requests before se


From: Philippe Mathieu-Daudé
Subject: Re: [RFC PATCH-for-5.1 v2] hw/ide: Cancel pending DMA requests before setting as inactive
Date: Fri, 17 Jul 2020 12:11:55 +0200
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.5.0

On 7/17/20 12:08 PM, Philippe Mathieu-Daudé wrote:
> On 7/17/20 9:53 AM, Philippe Mathieu-Daudé wrote:
>> libFuzzer found a case where requests are queued for later in the
>> AIO context, but a command set the bus inactive, then when finally
>> the requests are processed by the DMA it aborts because it is
>> inactive:
>>
>>  include/hw/ide/pci.h:59: IDEState *bmdma_active_if(BMDMAState *): Assertion 
>> `bmdma->bus->retry_unit != (uint8_t)-1' failed.
>>
>> Reproducer available on the BugLink.
>>
>> Fix by draining the pending DMA requests before inactivating the bus.
>>
> 

Sorry I also forgot:

Reported-by: Alexander Bulekov <alxndr@bu.edu>

> Fixes: 8ccad811e6 ("use AIO for DMA transfers - enabled DMA for CDROMs")
> 
>> BugLink: https://bugs.launchpad.net/qemu/+bug/1887303
>> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
>> ---
>> RFC because I don't have much clue about block drive and IDE,
>> so block-team please be very careful while reviewing this bug.
>> ---
>>  hw/ide/core.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/hw/ide/core.c b/hw/ide/core.c
>> index d997a78e47..f7affafb0c 100644
>> --- a/hw/ide/core.c
>> +++ b/hw/ide/core.c
>> @@ -804,7 +804,7 @@ void dma_buf_commit(IDEState *s, uint32_t tx_bytes)
>>  
>>  void ide_set_inactive(IDEState *s, bool more)
>>  {
>> -    s->bus->dma->aiocb = NULL;
>> +    ide_cancel_dma_sync(s);
>>      ide_clear_retry(s);
>>      if (s->bus->dma->ops->set_inactive) {
>>          s->bus->dma->ops->set_inactive(s->bus->dma, more);
>>
> 



reply via email to

[Prev in Thread] Current Thread [Next in Thread]